Current Status

This blog is not frequently updated because most case-by-case scam reports are now listed in subordinate blogs. At this point in time, most of my efforts are targeted at documenting employment scams in the Suckers Wanted blog.

2006-06-26

Job Scam: Global Austrian Syndicate (gas-limited.com)

The "Global Austrian Syndicate" crooks are at it again. They've done the same thing before with gas-ltd.biz and gas-ltd.cn, and recently they wore a different hat with adamsgreen.org. Those domains have all been neutered, so this time they're back with "gas-limited.com". Specifically, this spam links to http://gas-limited.com/html/index.php?sect_id=5.

At the time of writing, the one nameserver for the domain which was responding (at 207.210.93.181) gave the following answer to an address query.

; <<>> DiG 9.3.1 <<>> A gas-limited.com @207.210.93.181
; (1 server found)
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56905
;; flags: qr aa rd; QUERY: 1, ANSWER: 5, AUTHORITY: 2, ADDITIONAL: 2

;; QUESTION SECTION:
;gas-limited.com.               IN      A

;; ANSWER SECTION:
gas-limited.com.        1800    IN      A       70.239.73.247
gas-limited.com.        1800    IN      A       81.101.95.9
gas-limited.com.        1800    IN      A       201.151.39.83
gas-limited.com.        1800    IN      A       24.12.203.230
gas-limited.com.        1800    IN      A       69.81.155.153

;; AUTHORITY SECTION:
gas-limited.com.        1800    IN      NS      ns2.get-site.com.
gas-limited.com.        1800    IN      NS      ns1.get-site.com.

;; ADDITIONAL SECTION:
ns1.get-site.com.       1800    IN      A       207.210.93.181
ns2.get-site.com.       1800    IN      A       204.21.41.81

;; Query time: 222 msec
;; SERVER: 207.210.93.181#53(207.210.93.181)
;; WHEN: Tue Jun 27 04:36:58 2006
;; MSG SIZE  rcvd: 190

I'm leaving it as an exercise to the reader to determine whether the addresses returned in this query are customer systems on broadband networks, as has been the case in times past. (Hint: yes, they are.)

No comments: